@fabricorg/platform 0.12.0 → 1.0.0

package/dist/chunk-53VEUYCS.cjs

@@ -0,0 +1,40 @@
+'use strict';
+
+// events/index.ts
+var BUILT_IN_SUBJECT_TYPES = Object.freeze([
+  "ActionInvocation",
+  "PolicyEvaluation",
+  "AdapterInvocation"
+]);
+var BUILT_IN_EVENT_TYPES = Object.freeze([
+  "ComplianceBlocked",
+  "StateTransitioned",
+  "AdapterInvocationStarted",
+  "AdapterInvocationSucceeded",
+  "AdapterInvocationFailed",
+  "WebhookReceived"
+]);
+function createEventContractRegistry(input = {}) {
+  const eventTypes = /* @__PURE__ */ new Set([...BUILT_IN_EVENT_TYPES, ...input.eventTypes ?? []]);
+  const subjectTypes = /* @__PURE__ */ new Set([...BUILT_IN_SUBJECT_TYPES, ...input.subjectTypes ?? []]);
+  return {
+    registerEventType(eventType) {
+      if (!eventType) {
+        throw new Error("Event type cannot be empty");
+      }
+      eventTypes.add(eventType);
+    },
+    registerSubjectType(subjectType) {
+      if (!subjectType) throw new Error("Subject type cannot be empty");
+      subjectTypes.add(subjectType);
+    },
+    hasEventType: (eventType) => eventTypes.has(eventType),
+    hasSubjectType: (subjectType) => subjectTypes.has(subjectType),
+    eventTypes: () => Array.from(eventTypes).sort(),
+    subjectTypes: () => Array.from(subjectTypes).sort()
+  };
+}
+
+exports.createEventContractRegistry = createEventContractRegistry;
+//# sourceMappingURL=chunk-53VEUYCS.cjs.map
+//# sourceMappingURL=chunk-53VEUYCS.cjs.map

package/dist/chunk-53VEUYCS.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../events/index.ts"],"names":[],"mappings":";;;AAyBA,IAAM,sBAAA,GAAyB,OAAO,MAAA,CAAO;AAAA,EAC5C,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACD,CAAC,CAAA;AAED,IAAM,oBAAA,GAAuB,OAAO,MAAA,CAAO;AAAA,EAC1C,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA,0BAAA;AAAA,EACA,4BAAA;AAAA,EACA,yBAAA;AAAA,EACA;AACD,CAAC,CAAA;AAeM,SAAS,2BAAA,CAA4B,KAAA,GAA8E,EAAC,EAA0B;AACpJ,EAAA,MAAM,UAAA,mBAAa,IAAI,GAAA,CAAI,CAAC,GAAG,oBAAA,EAAsB,GAAI,KAAA,CAAM,UAAA,IAAc,EAAG,CAAC,CAAA;AACjF,EAAA,MAAM,YAAA,mBAAe,IAAI,GAAA,CAAI,CAAC,GAAG,sBAAA,EAAwB,GAAI,KAAA,CAAM,YAAA,IAAgB,EAAG,CAAC,CAAA;AACvF,EAAA,OAAO;AAAA,IACN,kBAAkB,SAAA,EAAW;AAC5B,MAAA,IAAI,CAAC,SAAA,EAAW;AACf,QAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,MAC7C;AACA,MAAA,UAAA,CAAW,IAAI,SAAS,CAAA;AAAA,IACzB,CAAA;AAAA,IACA,oBAAoB,WAAA,EAAa;AAChC,MAAA,IAAI,CAAC,WAAA,EAAa,MAAM,IAAI,MAAM,8BAA8B,CAAA;AAChE,MAAA,YAAA,CAAa,IAAI,WAAW,CAAA;AAAA,IAC7B,CAAA;AAAA,IACA,YAAA,EAAc,CAAC,SAAA,KAAc,UAAA,CAAW,IAAI,SAAS,CAAA;AAAA,IACrD,cAAA,EAAgB,CAAC,WAAA,KAAgB,YAAA,CAAa,IAAI,WAAW,CAAA;AAAA,IAC7D,YAAY,MAAM,KAAA,CAAM,IAAA,CAAK,UAAU,EAAE,IAAA,EAAK;AAAA,IAC9C,cAAc,MAAM,KAAA,CAAM,IAAA,CAAK,YAAY,EAAE,IAAA;AAAK,GACnD;AACD","file":"chunk-53VEUYCS.cjs","sourcesContent":["export interface AssetEventEnvelope<TPayload = unknown> {\n\tid: string;\n\ttenantId: string;\n\tspaceId: string;\n\teventType: string;\n\teventSchemaVersion: number;\n\tsubjectType: string;\n\tsubjectId: string;\n\tactorId: string;\n\tactorType: string;\n\tactionInvocationId?: string;\n\tpayload: TPayload;\n\tsequence: number;\n\toccurredAt: Date;\n\trecordedAt: Date;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: EventProvenance;\n}\n\nexport interface EventProvenance {\n\tsource: \"ui\" | \"api\" | \"agent\" | \"worker\" | \"system\" | (string & {});\n\tauditAttributes?: Record<string, string>;\n}\n\nconst BUILT_IN_SUBJECT_TYPES = Object.freeze([\n\t\"ActionInvocation\",\n\t\"PolicyEvaluation\",\n\t\"AdapterInvocation\",\n]);\n\nconst BUILT_IN_EVENT_TYPES = Object.freeze([\n\t\"ComplianceBlocked\",\n\t\"StateTransitioned\",\n\t\"AdapterInvocationStarted\",\n\t\"AdapterInvocationSucceeded\",\n\t\"AdapterInvocationFailed\",\n\t\"WebhookReceived\",\n]);\n\nexport type AssetEventSubjectType = string;\nexport type AssetEventType = string;\nexport type AssetEventActorType = \"natural_person\" | \"agent\" | \"adapter\" | \"system\" | \"service_account\" | \"external_system\" | \"integration\";\n\nexport interface EventContractRegistry {\n\tregisterEventType(eventType: string): void;\n\tregisterSubjectType(subjectType: string): void;\n\thasEventType(eventType: string): boolean;\n\thasSubjectType(subjectType: string): boolean;\n\teventTypes(): string[];\n\tsubjectTypes(): string[];\n}\n\nexport function createEventContractRegistry(input: { eventTypes?: readonly string[]; subjectTypes?: readonly string[] } = {}): EventContractRegistry {\n\tconst eventTypes = new Set([...BUILT_IN_EVENT_TYPES, ...(input.eventTypes ?? [])]);\n\tconst subjectTypes = new Set([...BUILT_IN_SUBJECT_TYPES, ...(input.subjectTypes ?? [])]);\n\treturn {\n\t\tregisterEventType(eventType) {\n\t\t\tif (!eventType) {\n\t\t\t\tthrow new Error(\"Event type cannot be empty\");\n\t\t\t}\n\t\t\teventTypes.add(eventType);\n\t\t},\n\t\tregisterSubjectType(subjectType) {\n\t\t\tif (!subjectType) throw new Error(\"Subject type cannot be empty\");\n\t\t\tsubjectTypes.add(subjectType);\n\t\t},\n\t\thasEventType: (eventType) => eventTypes.has(eventType),\n\t\thasSubjectType: (subjectType) => subjectTypes.has(subjectType),\n\t\teventTypes: () => Array.from(eventTypes).sort(),\n\t\tsubjectTypes: () => Array.from(subjectTypes).sort(),\n\t};\n}\n"]}

package/dist/{chunk-X7WC4AYC.js → chunk-ATWWZTRC.js}

@@ -2,57 +2,6 @@ import { createHash } from 'crypto';
 
 // privacy/engine.ts
 var ANONYMIZATION_POLICY_VERSION = "adr-026-platform-anonymization-v1";
-var DEFAULT_PRESERVED_SEMANTICS = [
-  "tenantId",
-  "spaceId",
-  "subjectType",
-  "subjectId",
-  "eventType",
-  "sequence",
-  "occurredAt",
-  "recordedAt",
-  "actionInvocationId",
-  "correlationId",
-  "causationId",
-  "financialDecisionFacts"
-];
-var FIELD_POLICIES = [
-  { match: "key", value: "password", method: "drop" },
-  { match: "key", value: "token", method: "drop" },
-  { match: "key", value: "apiKey", method: "drop" },
-  { match: "key", value: "authorization", method: "drop" },
-  { match: "key", value: "ssn", method: "nullify" },
-  { match: "key", value: "ssnLast4", method: "nullify" },
-  { match: "key", value: "socialSecurityNumber", method: "nullify" },
-  { match: "key", value: "dateOfBirth", method: "nullify" },
-  { match: "key", value: "dob", method: "nullify" },
-  { match: "key", value: "driverLicense", method: "nullify" },
-  { match: "key", value: "firstName", method: "tokenize" },
-  { match: "key", value: "middleName", method: "tokenize" },
-  { match: "key", value: "lastName", method: "tokenize" },
-  { match: "key", value: "fullName", method: "tokenize" },
-  { match: "key", value: "name", method: "tokenize" },
-  { match: "key", value: "email", method: "tokenize" },
-  { match: "key", value: "emailAddress", method: "tokenize" },
-  { match: "key", value: "phone", method: "tokenize" },
-  { match: "key", value: "phoneNumber", method: "tokenize" },
-  { match: "key", value: "mobilePhone", method: "tokenize" },
-  { match: "key", value: "homePhone", method: "tokenize" },
-  { match: "key", value: "workPhone", method: "tokenize" },
-  { match: "key", value: "street", method: "nullify" },
-  { match: "key", value: "streetAddress", method: "nullify" },
-  { match: "key", value: "address", method: "nullify" },
-  { match: "key", value: "mailingAddress", method: "nullify" },
-  { match: "key", value: "partnerLeadId", method: "tokenize" },
-  { match: "key", value: "externalLeadId", method: "tokenize" },
-  { match: "key", value: "loanApplicationId", method: "tokenize" },
-  { match: "key", value: "vin", method: "tokenize" },
-  { match: "key", value: "rawVin", method: "tokenize" }
-];
-var NORMALIZED_FIELD_POLICIES = FIELD_POLICIES.map((policy) => ({
-  ...policy,
-  value: normalizeKey(policy.value)
-}));
 function normalizeKey(key) {
   return key.replace(/[^a-zA-Z0-9]/g, "").toLowerCase();
 }
@@ -98,21 +47,22 @@ function applyMethod(value, method, context, path) {
       return generalizeValue(value);
   }
 }
-function policyForPath(path, key) {
+function policyForPath(policies, path, key) {
   const normalizedPath = normalizeKey(path);
   const normalizedKey = key ? normalizeKey(key) : void 0;
-  return NORMALIZED_FIELD_POLICIES.find((policy) => {
+  return policies.find((policy) => {
+    const normalizedValue = normalizeKey(policy.value);
     if (policy.match === "key") {
-      return policy.value === normalizedKey;
+      return normalizedValue === normalizedKey;
     }
-    return policy.value === normalizedPath;
+    return normalizedValue === normalizedPath;
   });
 }
 function isPlainObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
 }
-function anonymizeRecursive(value, context, dataClass, path, redactedFields, key) {
-  const fieldPolicy = policyForPath(path, key);
+function anonymizeRecursive(value, context, dataClass, path, redactedFields, policies, key) {
+  const fieldPolicy = policyForPath(policies, path, key);
   if (fieldPolicy && value !== null && value !== void 0) {
     redactedFields.push({
       fieldPath: path,
@@ -128,7 +78,7 @@ function anonymizeRecursive(value, context, dataClass, path, redactedFields, key
   }
   if (Array.isArray(value)) {
     return value.map(
-      (item, index) => anonymizeRecursive(item, context, dataClass, `${path}[${index}]`, redactedFields)
+      (item, index) => anonymizeRecursive(item, context, dataClass, `${path}[${index}]`, redactedFields, policies)
     );
   }
   if (!isPlainObject(value)) {
@@ -146,6 +96,7 @@ function anonymizeRecursive(value, context, dataClass, path, redactedFields, key
       dataClass,
       `${path}.${childKey}`,
       redactedFields,
+      policies,
       childKey
     );
     if (anonymized !== void 0) {
@@ -154,7 +105,7 @@ function anonymizeRecursive(value, context, dataClass, path, redactedFields, key
   }
   return result;
 }
-function buildMetadata(context, dataClass, redactedFields) {
+function buildMetadata(context, dataClass, redactedFields, preservedSemantics) {
   return {
     redactionState: "anonymized",
     policyVersion: context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,
@@ -163,7 +114,7 @@ function buildMetadata(context, dataClass, redactedFields) {
     reason: context.reason,
     dataClass,
     redactedFields,
-    preservedSemantics: DEFAULT_PRESERVED_SEMANTICS
+    preservedSemantics: [...preservedSemantics]
   };
 }
 var FieldRedactor = class {
@@ -184,6 +135,13 @@ var FieldRedactor = class {
   }
 };
 var AnonymizationEngine = class {
+  #policy;
+  constructor(policy) {
+    this.#policy = {
+      fields: policy.fields.map((field) => ({ ...field })),
+      preservedSemantics: [...policy.preservedSemantics ?? []]
+    };
+  }
   anonymizeJsonValue(value, context, dataClass) {
     return this.anonymizeJsonValueAtPath(value, context, dataClass, "$");
   }
@@ -194,11 +152,12 @@ var AnonymizationEngine = class {
       context,
       dataClass,
       basePath,
-      redactedFields
+      redactedFields,
+      this.#policy.fields
     );
     return {
       value: anonymizedValue,
-      metadata: buildMetadata(context, dataClass, redactedFields)
+      metadata: buildMetadata(context, dataClass, redactedFields, this.#policy.preservedSemantics ?? [])
     };
   }
   anonymizeAssetEventPayload(event, context) {
@@ -284,27 +243,26 @@ var AnonymizationEngine = class {
           )
         }))
       ],
-      preservedSemantics: DEFAULT_PRESERVED_SEMANTICS
+      preservedSemantics: [...this.#policy.preservedSemantics ?? []]
     };
   }
 };
 
 // privacy/index.ts
 var PLATFORM_PRIVACY_POLICY_VERSION = "fabric-platform-privacy-v1";
-var defaultEngine = new AnonymizationEngine();
-function anonymizeJsonValue(value, context, dataClass) {
-  return defaultEngine.anonymizeJsonValue(value, context, dataClass);
+function anonymizeJsonValue(value, context, dataClass, policy) {
+  return new AnonymizationEngine(policy).anonymizeJsonValue(value, context, dataClass);
 }
-function anonymizeAssetEventPayload(event, context) {
-  return defaultEngine.anonymizeAssetEventPayload(event, context);
+function anonymizeAssetEventPayload(event, context, policy) {
+  return new AnonymizationEngine(policy).anonymizeAssetEventPayload(event, context);
 }
-function anonymizeEvidencePacket(packet, context) {
-  return defaultEngine.anonymizeEvidencePacket(packet, context);
+function anonymizeEvidencePacket(packet, context, policy) {
+  return new AnonymizationEngine(policy).anonymizeEvidencePacket(packet, context);
 }
-function buildAnonymizationLifecycleEvidence(input) {
-  return defaultEngine.buildAnonymizationLifecycleEvidence(input);
+function buildAnonymizationLifecycleEvidence(input, policy) {
+  return new AnonymizationEngine(policy).buildAnonymizationLifecycleEvidence(input);
 }
 
 export { ANONYMIZATION_POLICY_VERSION, AnonymizationEngine, FieldRedactor, PLATFORM_PRIVACY_POLICY_VERSION, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, buildAnonymizationLifecycleEvidence, stableChecksum };
-//# sourceMappingURL=chunk-X7WC4AYC.js.map
-//# sourceMappingURL=chunk-X7WC4AYC.js.map
+//# sourceMappingURL=chunk-ATWWZTRC.js.map
+//# sourceMappingURL=chunk-ATWWZTRC.js.map

package/dist/chunk-ATWWZTRC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../privacy/engine.ts","../privacy/index.ts"],"names":[],"mappings":";;;AAWO,IAAM,4BAAA,GAA+B;AAgE5C,SAAS,aAAa,GAAA,EAAqB;AAC1C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,eAAA,EAAiB,EAAE,EAAE,WAAA,EAAY;AACrD;AAEO,SAAS,eAAe,KAAA,EAAwB;AACtD,EAAA,OAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,IAAA,CAAK,UAAU,KAAK,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACvE;AAEA,SAAS,iBAAA,CACR,KAAA,EACA,OAAA,EACA,SAAA,EACS;AACT,EAAA,MAAM,KAAA,GAAQ,GAAG,OAAA,CAAQ,QAAQ,IAAI,OAAA,CAAQ,OAAA,IAAW,QAAQ,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AAC7E,EAAA,OAAO,CAAA,IAAA,EAAO,WAAW,QAAQ,CAAA,CAC/B,OAAO,CAAA,EAAG,OAAA,CAAQ,aAAA,IAAiB,4BAA4B,CAAA,CAAA,EAAI,KAAK,IAAI,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA,CAC3F,MAAA,CAAO,KAAK,CAAA,CACZ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AACf;AAEA,SAAS,UAAU,KAAA,EAA+B;AACjD,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW;AAC1C,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,MAAM,WAAA,GAAc,OAAO,KAAK,CAAA;AAChC,EAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC5B,IAAA,OAAO,MAAA;AAAA,EACR;AAEA,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG,CAAC,CAAC,CAAC,CAAA,EAAG,WAAA,CAAY,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAClF;AAEA,SAAS,gBAAgB,KAAA,EAAyB;AACjD,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA,GAAI,GAAA;AAAA,EACnC;AAEA,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,oBAAA,CAAqB,IAAA,CAAK,KAAK,CAAA,EAAG;AAClE,IAAA,OAAO,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,EAAA,CAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,IAAA;AACR;AAEA,SAAS,WAAA,CACR,KAAA,EACA,MAAA,EACA,OAAA,EACA,IAAA,EACU;AACV,EAAA,QAAQ,MAAA;AAAQ,IACf,KAAK,MAAA;AACJ,MAAA,OAAO,MAAA;AAAA,IACR,KAAK,SAAA;AACJ,MAAA,OAAO,IAAA;AAAA,IACR,KAAK,MAAA;AACJ,MAAA,OAAO,UAAU,KAAK,CAAA;AAAA,IACvB,KAAK,MAAA;AACJ,MAAA,OAAO,CAAA,OAAA,EAAU,cAAA,CAAe,KAAK,CAAC,CAAA,CAAA;AAAA,IACvC,KAAK,UAAA;AACJ,MAAA,OAAO,iBAAA,CAAkB,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA;AAAA,IAC9C,KAAK,YAAA;AACJ,MAAA,OAAO,gBAAgB,KAAK,CAAA;AAAA;AAE/B;AAEA,SAAS,aAAA,CAAc,QAAA,EAA+C,IAAA,EAAc,GAAA,EAAoD;AACvI,EAAA,MAAM,cAAA,GAAiB,aAAa,IAAI,CAAA;AACxC,EAAA,MAAM,aAAA,GAAgB,GAAA,GAAM,YAAA,CAAa,GAAG,CAAA,GAAI,MAAA;AAEhD,EAAA,OAAO,QAAA,CAAS,IAAA,CAAK,CAAC,MAAA,KAAW;AAChC,IAAA,MAAM,eAAA,GAAkB,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AACjD,IAAA,IAAI,MAAA,CAAO,UAAU,KAAA,EAAO;AAC3B,MAAA,OAAO,eAAA,KAAoB,aAAA;AAAA,IAC5B;AAEA,IAAA,OAAO,eAAA,KAAoB,cAAA;AAAA,EAC5B,CAAC,CAAA;AACF;AAEA,SAAS,cAAc,KAAA,EAAqC;AAC3D,EAAA,OACC,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,EAAE,KAAA,YAAiB,IAAA,CAAA;AAE7F;AAEA,SAAS,mBACR,KAAA,EACA,OAAA,EACA,WACA,IAAA,EACA,cAAA,EACA,UACA,GAAA,EACU;AACV,EAAA,MAAM,WAAA,GAAc,aAAA,CAAc,QAAA,EAAU,IAAA,EAAM,GAAG,CAAA;AACrD,EAAA,IAAI,WAAA,IAAe,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW;AACzD,IAAA,cAAA,CAAe,IAAA,CAAK;AAAA,MACnB,SAAA,EAAW,IAAA;AAAA,MACX,QAAQ,WAAA,CAAY,MAAA;AAAA,MACpB,aAAA,EAAe,QAAQ,aAAA,IAAiB,4BAAA;AAAA,MACxC,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,aAAa,OAAA,CAAQ,UAAA,oBAAc,IAAI,IAAA,IAAQ,WAAA,EAAY;AAAA,MAC3D,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,SAAA;AAAA,MACA,cAAA,EAAgB,eAAe,KAAK;AAAA,KACpC,CAAA;AAED,IAAA,OAAO,WAAA,CAAY,KAAA,EAAO,WAAA,CAAY,MAAA,EAAQ,SAAS,IAAI,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO,KAAA,CAAM,GAAA;AAAA,MAAI,CAAC,IAAA,EAAM,KAAA,KACvB,kBAAA,CAAmB,IAAA,EAAM,OAAA,EAAS,SAAA,EAAW,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,CAAA,EAAK,gBAAgB,QAAQ;AAAA,KAC3F;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG;AAC1B,IAAA,OAAO,KAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,CAAC,QAAA,EAAU,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC3D,IAAA,IAAI,aAAa,UAAA,EAAY;AAC5B,MAAA,MAAA,CAAO,QAAQ,CAAA,GAAI,UAAA;AACnB,MAAA;AAAA,IACD;AAEA,IAAA,MAAM,UAAA,GAAa,kBAAA;AAAA,MAClB,UAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AAAA,MACnB,cAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,IAAI,eAAe,MAAA,EAAW;AAC7B,MAAA,MAAA,CAAO,QAAQ,CAAA,GAAI,UAAA;AAAA,IACpB;AAAA,EACD;AAEA,EAAA,OAAO,MAAA;AACR;AAEA,SAAS,aAAA,CACR,OAAA,EACA,SAAA,EACA,cAAA,EACA,kBAAA,EACwB;AACxB,EAAA,OAAO;AAAA,IACN,cAAA,EAAgB,YAAA;AAAA,IAChB,aAAA,EAAe,QAAQ,aAAA,IAAiB,4BAAA;AAAA,IACxC,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,aAAa,OAAA,CAAQ,UAAA,oBAAc,IAAI,IAAA,IAAQ,WAAA,EAAY;AAAA,IAC3D,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,SAAA;AAAA,IACA,cAAA;AAAA,IACA,kBAAA,EAAoB,CAAC,GAAG,kBAAkB;AAAA,GAC3C;AACD;AAEO,IAAM,gBAAN,MAAoB;AAAA,EAC1B,WAAA,CAAY,KAAA,EAAgB,MAAA,EAAyB,OAAA,EAA+B,IAAA,EAAuB;AAC1G,IAAA,OAAO,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,EAChD;AAAA,EAEA,KAAK,KAAA,EAA+B;AACnC,IAAA,OAAO,UAAU,KAAK,CAAA;AAAA,EACvB;AAAA,EAEA,KAAK,KAAA,EAAwB;AAC5B,IAAA,OAAO,CAAA,OAAA,EAAU,cAAA,CAAe,KAAK,CAAC,CAAA,CAAA;AAAA,EACvC;AAAA,EAEA,QAAA,CAAS,KAAA,EAAgB,OAAA,EAA+B,IAAA,EAAsB;AAC7E,IAAA,OAAO,iBAAA,CAAkB,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA;AAAA,EAC9C;AAAA,EAEA,WAAW,KAAA,EAAyB;AACnC,IAAA,OAAO,gBAAgB,KAAK,CAAA;AAAA,EAC7B;AACD;AAEO,IAAM,sBAAN,MAA0B;AAAA,EACvB,OAAA;AAAA,EAET,YAAY,MAAA,EAA6B;AACxC,IAAA,IAAA,CAAK,OAAA,GAAU;AAAA,MACd,MAAA,EAAQ,OAAO,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,MAAW,EAAE,GAAG,KAAA,EAAM,CAAE,CAAA;AAAA,MACnD,oBAAoB,CAAC,GAAI,MAAA,CAAO,kBAAA,IAAsB,EAAG;AAAA,KAC1D;AAAA,EACD;AAAA,EAEA,kBAAA,CACC,KAAA,EACA,OAAA,EACA,SAAA,EAC8B;AAC9B,IAAA,OAAO,IAAA,CAAK,wBAAA,CAAyB,KAAA,EAAO,OAAA,EAAS,WAAW,GAAG,CAAA;AAAA,EACpE;AAAA,EAEA,wBAAA,CACC,KAAA,EACA,OAAA,EACA,SAAA,EACA,QAAA,EAC8B;AAC9B,IAAA,MAAM,iBAA+C,EAAC;AACtD,IAAA,MAAM,eAAA,GAAkB,kBAAA;AAAA,MACvB,KAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA,cAAA;AAAA,MACA,KAAK,OAAA,CAAQ;AAAA,KACd;AAEA,IAAA,OAAO;AAAA,MACN,KAAA,EAAO,eAAA;AAAA,MACP,QAAA,EAAU,cAAc,OAAA,EAAS,SAAA,EAAW,gBAAgB,IAAA,CAAK,OAAA,CAAQ,kBAAA,IAAsB,EAAE;AAAA,KAClG;AAAA,EACD;AAAA,EAEA,0BAAA,CACC,OACA,OAAA,EAC+B;AAC/B,IAAA,MAAM,SAAS,IAAA,CAAK,kBAAA,CAAmB,KAAA,CAAM,OAAA,EAAS,SAAS,aAAa,CAAA;AAC5E,IAAA,MAAM,UAAU,aAAA,CAAc,MAAA,CAAO,KAAK,CAAA,GACvC,EAAE,GAAG,MAAA,CAAO,KAAA,EAAO,UAAU,MAAA,CAAO,QAAA,KACpC,EAAE,KAAA,EAAO,OAAO,KAAA,EAAO,QAAA,EAAU,OAAO,QAAA,EAAS;AAEpD,IAAA,OAAO,EAAE,KAAA,EAAO,OAAA,EAAS,QAAA,EAAU,OAAO,QAAA,EAAS;AAAA,EACpD;AAAA,EAEA,uBAAA,CACC,QACA,OAAA,EAC6F;AAC7F,IAAA,MAAM,SAAS,IAAA,CAAK,kBAAA,CAAmB,MAAA,CAAO,MAAA,EAAQ,SAAS,iBAAiB,CAAA;AAChF,IAAA,MAAM,iBAAA,GAAoB;AAAA,MACzB,GAAI,aAAA,CAAc,MAAA,CAAO,iBAAiB,CAAA,GAAI,MAAA,CAAO,oBAAoB,EAAC;AAAA,MAC1E,wBAAwB,MAAA,CAAO;AAAA,KAChC;AACA,IAAA,MAAM,mBAAmB,aAAA,CAAc,MAAA,CAAO,KAAK,CAAA,GAChD,EAAE,GAAG,MAAA,CAAO,KAAA,EAAO,UAAU,MAAA,CAAO,QAAA,KACpC,EAAE,KAAA,EAAO,OAAO,KAAA,EAAO,QAAA,EAAU,OAAO,QAAA,EAAS;AAEpD,IAAA,OAAO;AAAA,MACN,KAAA,EAAO;AAAA,QACN,MAAA,EAAQ,gBAAA;AAAA,QACR,iBAAA;AAAA,QACA,UAAU,cAAA,CAAe,EAAE,MAAA,EAAQ,gBAAA,EAAkB,mBAAmB;AAAA,OACzE;AAAA,MACA,UAAU,MAAA,CAAO;AAAA,KAClB;AAAA,EACD;AAAA,EAEA,oCAAoC,KAAA,EASD;AAClC,IAAA,MAAM,WAAA,GAAc,KAAA,CAAM,WAAA,IAAe,EAAC;AAC1C,IAAA,MAAM,UAAA,GAAa,KAAA,CAAM,UAAA,IAAc,EAAC;AACxC,IAAA,MAAM,eAAA,GAAkB,KAAA,CAAM,eAAA,IAAmB,EAAC;AAClD,IAAA,MAAM,cAAA,GAAiB;AAAA,MACtB,GAAG,WAAA,CAAY,OAAA,CAAQ,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,cAAc,CAAA;AAAA,MAC7D,GAAG,UAAA,CAAW,OAAA,CAAQ,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,cAAc,CAAA;AAAA,MAC5D,GAAG,eAAA,CAAgB,OAAA,CAAQ,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,cAAc;AAAA,KAClE;AAEA,IAAA,OAAO;AAAA,MACN,SAAA,EAAW,sBAAA;AAAA,MACX,aAAA,EAAe,KAAA,CAAM,OAAA,CAAQ,aAAA,IAAiB,4BAAA;AAAA,MAC9C,KAAA,EAAO,MAAM,OAAA,CAAQ,KAAA;AAAA,MACrB,MAAA,EAAQ,MAAM,OAAA,CAAQ,MAAA;AAAA,MACtB,YAAY,KAAA,CAAM,OAAA,CAAQ,8BAAc,IAAI,IAAA,IAAQ,WAAA,EAAY;AAAA,MAChE,QAAA,EAAU,MAAM,OAAA,CAAQ,QAAA;AAAA,MACxB,OAAA,EAAS,KAAA,CAAM,OAAA,CAAQ,OAAA,IAAW,IAAA;AAAA,MAClC,MAAA,EAAQ;AAAA,QACP,aAAa,WAAA,CAAY,MAAA;AAAA,QACzB,YAAY,UAAA,CAAW,MAAA;AAAA,QACvB,iBAAiB,eAAA,CAAgB,MAAA;AAAA,QACjC,gBAAgB,cAAA,CAAe;AAAA,OAChC;AAAA,MACA,OAAA,EAAS;AAAA,QACR,GAAG,WAAA,CAAY,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,UAC7B,WAAA,EAAa,aAAA;AAAA,UACb,QAAA,EAAU,KAAK,KAAA,CAAM,EAAA;AAAA,UACrB,WAAA,EAAa,KAAK,KAAA,CAAM,WAAA;AAAA,UACxB,SAAA,EAAW,KAAK,KAAA,CAAM,SAAA;AAAA,UACtB,aAAA,EAAe,IAAA,CAAK,QAAA,CAAS,cAAA,CAAe,GAAA;AAAA,YAC3C,CAAC,EAAE,SAAA,EAAW,MAAA,EAAQ,gBAAe,MAAO;AAAA,cAC3C,SAAA;AAAA,cACA,MAAA;AAAA,cACA;AAAA,aACD;AAAA;AACD,SACD,CAAE,CAAA;AAAA,QACF,GAAG,UAAA,CAAW,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,UAC5B,WAAA,EAAa,YAAA;AAAA,UACb,QAAA,EAAU,KAAK,MAAA,CAAO,EAAA;AAAA,UACtB,aAAa,IAAA,CAAK,SAAA;AAAA,UAClB,SAAA,EAAW,KAAK,MAAA,CAAO,EAAA;AAAA,UACvB,aAAA,EAAe,IAAA,CAAK,QAAA,CAAS,cAAA,CAAe,GAAA;AAAA,YAC3C,CAAC,EAAE,SAAA,EAAW,MAAA,EAAQ,gBAAe,MAAO;AAAA,cAC3C,SAAA;AAAA,cACA,MAAA;AAAA,cACA;AAAA,aACD;AAAA;AACD,SACD,CAAE,CAAA;AAAA,QACF,GAAG,eAAA,CAAgB,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,UACjC,WAAA,EAAa,iBAAA;AAAA,UACb,QAAA,EAAU,KAAK,MAAA,CAAO,EAAA;AAAA,UACtB,aAAA,EAAe,IAAA,CAAK,QAAA,CAAS,cAAA,CAAe,GAAA;AAAA,YAC3C,CAAC,EAAE,SAAA,EAAW,MAAA,EAAQ,gBAAe,MAAO;AAAA,cAC3C,SAAA;AAAA,cACA,MAAA;AAAA,cACA;AAAA,aACD;AAAA;AACD,SACD,CAAE;AAAA,OACH;AAAA,MACA,oBAAoB,CAAC,GAAI,KAAK,OAAA,CAAQ,kBAAA,IAAsB,EAAG;AAAA,KAChE;AAAA,EACD;AACD;;;AC5ZO,IAAM,+BAAA,GAAkC;AAuBxC,SAAS,kBAAA,CACf,KAAA,EACA,OAAA,EACA,SAAA,EACA,MAAA,EACgD;AAChD,EAAA,OAAO,IAAI,mBAAA,CAAoB,MAAM,EAAE,kBAAA,CAAmB,KAAA,EAAO,SAAS,SAAS,CAAA;AACpF;AAEO,SAAS,0BAAA,CACf,KAAA,EACA,OAAA,EACA,MAAA,EACiD;AACjD,EAAA,OAAO,IAAI,mBAAA,CAAoB,MAAM,CAAA,CAAE,0BAAA,CAA2B,OAAO,OAAO,CAAA;AACjF;AAEO,SAAS,uBAAA,CACf,MAAA,EACA,OAAA,EACA,MAAA,EAC+G;AAC/G,EAAA,OAAO,IAAI,mBAAA,CAAoB,MAAM,CAAA,CAAE,uBAAA,CAAwB,QAAQ,OAAO,CAAA;AAC/E;AAEO,SAAS,mCAAA,CAAoC,OASjD,MAAA,EAAgF;AAClF,EAAA,OAAO,IAAI,mBAAA,CAAoB,MAAM,CAAA,CAAE,oCAAoC,KAAK,CAAA;AACjF","file":"chunk-ATWWZTRC.js","sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport type {\n\tAnonymizationContext,\n\tAnonymizationFieldMetadata,\n\tAnonymizationMetadata,\n\tAnonymizationResult,\n\tPlatformDataClass,\n\tRedactionMethod,\n} from \"./index\";\n\nexport const ANONYMIZATION_POLICY_VERSION = \"adr-026-platform-anonymization-v1\";\n\ntype JsonObject = Record<string, unknown>;\n\nexport interface AnonymizationFieldPolicy {\n\tmethod: RedactionMethod;\n\tmatch: \"key\" | \"path\";\n\tvalue: string;\n}\n\nexport interface AnonymizationPolicy {\n\tfields: readonly AnonymizationFieldPolicy[];\n\tpreservedSemantics?: readonly string[];\n}\n\nexport interface AssetEventLike {\n\tid: string;\n\ttenantId: string;\n\tspaceId: string;\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tactionInvocationId: string;\n\tpayload: unknown;\n\tsequence: number;\n\toccurredAt: Date;\n\trecordedAt: Date;\n\tcorrelationId: string;\n\tcausationId?: string | null;\n}\n\nexport interface EvidencePacketLike {\n\tid: string;\n\tpacket: unknown;\n\tredactionMetadata: unknown;\n\tchecksum: string;\n}\n\nexport interface AnonymizationLifecycleEvidence {\n\teventType: \"AnonymizationApplied\";\n\tpolicyVersion: string;\n\tjobId: string;\n\treason: string;\n\tappliedAt: string;\n\ttenantId: string;\n\tspaceId: string | null;\n\tcounts: {\n\t\tassetEvents: number;\n\t\treadModels: number;\n\t\tevidencePackets: number;\n\t\tredactedFields: number;\n\t};\n\trecords: Array<{\n\t\trecordClass: PlatformDataClass;\n\t\trecordId: string;\n\t\tsubjectType?: string;\n\t\tsubjectId?: string;\n\t\tfieldManifest: Array<\n\t\t\tPick<AnonymizationFieldMetadata, \"fieldPath\" | \"method\" | \"beforeChecksum\">\n\t\t>;\n\t}>;\n\tpreservedSemantics: string[];\n}\n\nfunction normalizeKey(key: string): string {\n\treturn key.replace(/[^a-zA-Z0-9]/g, \"\").toLowerCase();\n}\n\nexport function stableChecksum(value: unknown): string {\n\treturn createHash(\"sha256\").update(JSON.stringify(value)).digest(\"hex\");\n}\n\nfunction stableScopedToken(\n\tvalue: unknown,\n\tcontext: AnonymizationContext,\n\tfieldPath: string,\n): string {\n\tconst scope = `${context.tenantId}:${context.spaceId ?? \"global\"}:${fieldPath}`;\n\treturn `tok_${createHash(\"sha256\")\n\t\t.update(`${context.policyVersion ?? ANONYMIZATION_POLICY_VERSION}:${scope}:${String(value)}`)\n\t\t.digest(\"hex\")\n\t\t.slice(0, 24)}`;\n}\n\nfunction maskValue(value: unknown): string | null {\n\tif (value === null || value === undefined) {\n\t\treturn null;\n\t}\n\n\tconst stringValue = String(value);\n\tif (stringValue.length <= 4) {\n\t\treturn \"****\";\n\t}\n\n\treturn `${\"*\".repeat(Math.max(stringValue.length - 4, 4))}${stringValue.slice(-4)}`;\n}\n\nfunction generalizeValue(value: unknown): unknown {\n\tif (typeof value === \"number\") {\n\t\treturn Math.round(value / 1000) * 1000;\n\t}\n\n\tif (typeof value === \"string\" && /^\\d{5}(?:-\\d{4})?$/.test(value)) {\n\t\treturn `${value.slice(0, 3)}**`;\n\t}\n\n\treturn null;\n}\n\nfunction applyMethod(\n\tvalue: unknown,\n\tmethod: RedactionMethod,\n\tcontext: AnonymizationContext,\n\tpath: string,\n): unknown {\n\tswitch (method) {\n\t\tcase \"drop\":\n\t\t\treturn undefined;\n\t\tcase \"nullify\":\n\t\t\treturn null;\n\t\tcase \"mask\":\n\t\t\treturn maskValue(value);\n\t\tcase \"hash\":\n\t\t\treturn `sha256_${stableChecksum(value)}`;\n\t\tcase \"tokenize\":\n\t\t\treturn stableScopedToken(value, context, path);\n\t\tcase \"generalize\":\n\t\t\treturn generalizeValue(value);\n\t}\n}\n\nfunction policyForPath(policies: readonly AnonymizationFieldPolicy[], path: string, key?: string): AnonymizationFieldPolicy | undefined {\n\tconst normalizedPath = normalizeKey(path);\n\tconst normalizedKey = key ? normalizeKey(key) : undefined;\n\n\treturn policies.find((policy) => {\n\t\tconst normalizedValue = normalizeKey(policy.value);\n\t\tif (policy.match === \"key\") {\n\t\t\treturn normalizedValue === normalizedKey;\n\t\t}\n\n\t\treturn normalizedValue === normalizedPath;\n\t});\n}\n\nfunction isPlainObject(value: unknown): value is JsonObject {\n\treturn (\n\t\tBoolean(value) && typeof value === \"object\" && !Array.isArray(value) && !(value instanceof Date)\n\t);\n}\n\nfunction anonymizeRecursive(\n\tvalue: unknown,\n\tcontext: AnonymizationContext,\n\tdataClass: PlatformDataClass,\n\tpath: string,\n\tredactedFields: AnonymizationFieldMetadata[],\n\tpolicies: readonly AnonymizationFieldPolicy[],\n\tkey?: string,\n): unknown {\n\tconst fieldPolicy = policyForPath(policies, path, key);\n\tif (fieldPolicy && value !== null && value !== undefined) {\n\t\tredactedFields.push({\n\t\t\tfieldPath: path,\n\t\t\tmethod: fieldPolicy.method,\n\t\t\tpolicyVersion: context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,\n\t\t\tjobId: context.jobId,\n\t\t\tredactedAt: (context.redactedAt ?? new Date()).toISOString(),\n\t\t\treason: context.reason,\n\t\t\tdataClass,\n\t\t\tbeforeChecksum: stableChecksum(value),\n\t\t});\n\n\t\treturn applyMethod(value, fieldPolicy.method, context, path);\n\t}\n\n\tif (Array.isArray(value)) {\n\t\treturn value.map((item, index) =>\n\t\t\tanonymizeRecursive(item, context, dataClass, `${path}[${index}]`, redactedFields, policies),\n\t\t);\n\t}\n\n\tif (!isPlainObject(value)) {\n\t\treturn value;\n\t}\n\n\tconst result: JsonObject = {};\n\tfor (const [childKey, childValue] of Object.entries(value)) {\n\t\tif (childKey === \"_privacy\") {\n\t\t\tresult[childKey] = childValue;\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst anonymized = anonymizeRecursive(\n\t\t\tchildValue,\n\t\t\tcontext,\n\t\t\tdataClass,\n\t\t\t`${path}.${childKey}`,\n\t\t\tredactedFields,\n\t\t\tpolicies,\n\t\t\tchildKey,\n\t\t);\n\n\t\tif (anonymized !== undefined) {\n\t\t\tresult[childKey] = anonymized;\n\t\t}\n\t}\n\n\treturn result;\n}\n\nfunction buildMetadata(\n\tcontext: AnonymizationContext,\n\tdataClass: PlatformDataClass,\n\tredactedFields: AnonymizationFieldMetadata[],\n\tpreservedSemantics: readonly string[],\n): AnonymizationMetadata {\n\treturn {\n\t\tredactionState: \"anonymized\",\n\t\tpolicyVersion: context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,\n\t\tjobId: context.jobId,\n\t\tredactedAt: (context.redactedAt ?? new Date()).toISOString(),\n\t\treason: context.reason,\n\t\tdataClass,\n\t\tredactedFields,\n\t\tpreservedSemantics: [...preservedSemantics],\n\t};\n}\n\nexport class FieldRedactor {\n\tredactField(value: unknown, method: RedactionMethod, context: AnonymizationContext, path: string): unknown {\n\t\treturn applyMethod(value, method, context, path);\n\t}\n\n\tmask(value: unknown): string | null {\n\t\treturn maskValue(value);\n\t}\n\n\thash(value: unknown): string {\n\t\treturn `sha256_${stableChecksum(value)}`;\n\t}\n\n\ttokenize(value: unknown, context: AnonymizationContext, path: string): string {\n\t\treturn stableScopedToken(value, context, path);\n\t}\n\n\tgeneralize(value: unknown): unknown {\n\t\treturn generalizeValue(value);\n\t}\n}\n\nexport class AnonymizationEngine {\n\treadonly #policy: AnonymizationPolicy;\n\n\tconstructor(policy: AnonymizationPolicy) {\n\t\tthis.#policy = {\n\t\t\tfields: policy.fields.map((field) => ({ ...field })),\n\t\t\tpreservedSemantics: [...(policy.preservedSemantics ?? [])],\n\t\t};\n\t}\n\n\tanonymizeJsonValue<TValue>(\n\t\tvalue: TValue,\n\t\tcontext: AnonymizationContext,\n\t\tdataClass: PlatformDataClass,\n\t): AnonymizationResult<TValue> {\n\t\treturn this.anonymizeJsonValueAtPath(value, context, dataClass, \"$\");\n\t}\n\n\tanonymizeJsonValueAtPath<TValue>(\n\t\tvalue: TValue,\n\t\tcontext: AnonymizationContext,\n\t\tdataClass: PlatformDataClass,\n\t\tbasePath: string,\n\t): AnonymizationResult<TValue> {\n\t\tconst redactedFields: AnonymizationFieldMetadata[] = [];\n\t\tconst anonymizedValue = anonymizeRecursive(\n\t\t\tvalue,\n\t\t\tcontext,\n\t\t\tdataClass,\n\t\t\tbasePath,\n\t\t\tredactedFields,\n\t\t\tthis.#policy.fields,\n\t\t) as TValue;\n\n\t\treturn {\n\t\t\tvalue: anonymizedValue,\n\t\t\tmetadata: buildMetadata(context, dataClass, redactedFields, this.#policy.preservedSemantics ?? []),\n\t\t};\n\t}\n\n\tanonymizeAssetEventPayload(\n\t\tevent: AssetEventLike,\n\t\tcontext: AnonymizationContext,\n\t): AnonymizationResult<unknown> {\n\t\tconst result = this.anonymizeJsonValue(event.payload, context, \"asset_event\");\n\t\tconst payload = isPlainObject(result.value)\n\t\t\t? { ...result.value, _privacy: result.metadata }\n\t\t\t: { value: result.value, _privacy: result.metadata };\n\n\t\treturn { value: payload, metadata: result.metadata };\n\t}\n\n\tanonymizeEvidencePacket(\n\t\tpacket: EvidencePacketLike,\n\t\tcontext: AnonymizationContext,\n\t): AnonymizationResult<Pick<EvidencePacketLike, \"packet\" | \"redactionMetadata\" | \"checksum\">> {\n\t\tconst result = this.anonymizeJsonValue(packet.packet, context, \"evidence_packet\");\n\t\tconst redactionMetadata = {\n\t\t\t...(isPlainObject(packet.redactionMetadata) ? packet.redactionMetadata : {}),\n\t\t\tlifecycleAnonymization: result.metadata,\n\t\t};\n\t\tconst anonymizedPacket = isPlainObject(result.value)\n\t\t\t? { ...result.value, _privacy: result.metadata }\n\t\t\t: { value: result.value, _privacy: result.metadata };\n\n\t\treturn {\n\t\t\tvalue: {\n\t\t\t\tpacket: anonymizedPacket,\n\t\t\t\tredactionMetadata,\n\t\t\t\tchecksum: stableChecksum({ packet: anonymizedPacket, redactionMetadata }),\n\t\t\t},\n\t\t\tmetadata: result.metadata,\n\t\t};\n\t}\n\n\tbuildAnonymizationLifecycleEvidence(input: {\n\t\tcontext: AnonymizationContext;\n\t\tassetEvents?: Array<{ event: AssetEventLike; metadata: AnonymizationMetadata }>;\n\t\treadModels?: Array<{\n\t\t\tmodelKind: string;\n\t\t\trecord: JsonObject & { id: string };\n\t\t\tmetadata: AnonymizationMetadata;\n\t\t}>;\n\t\tevidencePackets?: Array<{ packet: EvidencePacketLike; metadata: AnonymizationMetadata }>;\n\t}): AnonymizationLifecycleEvidence {\n\t\tconst assetEvents = input.assetEvents ?? [];\n\t\tconst readModels = input.readModels ?? [];\n\t\tconst evidencePackets = input.evidencePackets ?? [];\n\t\tconst redactedFields = [\n\t\t\t...assetEvents.flatMap((item) => item.metadata.redactedFields),\n\t\t\t...readModels.flatMap((item) => item.metadata.redactedFields),\n\t\t\t...evidencePackets.flatMap((item) => item.metadata.redactedFields),\n\t\t];\n\n\t\treturn {\n\t\t\teventType: \"AnonymizationApplied\",\n\t\t\tpolicyVersion: input.context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,\n\t\t\tjobId: input.context.jobId,\n\t\t\treason: input.context.reason,\n\t\t\tappliedAt: (input.context.redactedAt ?? new Date()).toISOString(),\n\t\t\ttenantId: input.context.tenantId,\n\t\t\tspaceId: input.context.spaceId ?? null,\n\t\t\tcounts: {\n\t\t\t\tassetEvents: assetEvents.length,\n\t\t\t\treadModels: readModels.length,\n\t\t\t\tevidencePackets: evidencePackets.length,\n\t\t\t\tredactedFields: redactedFields.length,\n\t\t\t},\n\t\t\trecords: [\n\t\t\t\t...assetEvents.map((item) => ({\n\t\t\t\t\trecordClass: \"asset_event\" as PlatformDataClass,\n\t\t\t\t\trecordId: item.event.id,\n\t\t\t\t\tsubjectType: item.event.subjectType,\n\t\t\t\t\tsubjectId: item.event.subjectId,\n\t\t\t\t\tfieldManifest: item.metadata.redactedFields.map(\n\t\t\t\t\t\t({ fieldPath, method, beforeChecksum }) => ({\n\t\t\t\t\t\t\tfieldPath,\n\t\t\t\t\t\t\tmethod,\n\t\t\t\t\t\t\tbeforeChecksum,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t})),\n\t\t\t\t...readModels.map((item) => ({\n\t\t\t\t\trecordClass: \"read_model\" as PlatformDataClass,\n\t\t\t\t\trecordId: item.record.id,\n\t\t\t\t\tsubjectType: item.modelKind,\n\t\t\t\t\tsubjectId: item.record.id,\n\t\t\t\t\tfieldManifest: item.metadata.redactedFields.map(\n\t\t\t\t\t\t({ fieldPath, method, beforeChecksum }) => ({\n\t\t\t\t\t\t\tfieldPath,\n\t\t\t\t\t\t\tmethod,\n\t\t\t\t\t\t\tbeforeChecksum,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t})),\n\t\t\t\t...evidencePackets.map((item) => ({\n\t\t\t\t\trecordClass: \"evidence_packet\" as PlatformDataClass,\n\t\t\t\t\trecordId: item.packet.id,\n\t\t\t\t\tfieldManifest: item.metadata.redactedFields.map(\n\t\t\t\t\t\t({ fieldPath, method, beforeChecksum }) => ({\n\t\t\t\t\t\t\tfieldPath,\n\t\t\t\t\t\t\tmethod,\n\t\t\t\t\t\t\tbeforeChecksum,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t})),\n\t\t\t],\n\t\t\tpreservedSemantics: [...(this.#policy.preservedSemantics ?? [])],\n\t\t};\n\t}\n}\n","export const PLATFORM_PRIVACY_POLICY_VERSION = \"fabric-platform-privacy-v1\";\n\nexport type RedactionMethod = \"nullify\" | \"mask\" | \"hash\" | \"tokenize\" | \"generalize\" | \"drop\";\n\nexport { ANONYMIZATION_POLICY_VERSION } from \"./engine\";\nexport {\n\tAnonymizationEngine,\n\tFieldRedactor,\n\tstableChecksum,\n\ttype AssetEventLike,\n\ttype EvidencePacketLike,\n\ttype AnonymizationLifecycleEvidence,\n\ttype AnonymizationFieldPolicy,\n\ttype AnonymizationPolicy,\n} from \"./engine\";\n\nimport {\n\tAnonymizationEngine,\n\ttype AssetEventLike,\n\ttype EvidencePacketLike,\n\ttype AnonymizationLifecycleEvidence,\n} from \"./engine\";\n\nexport function anonymizeJsonValue<TValue>(\n\tvalue: TValue,\n\tcontext: import(\"./index\").AnonymizationContext,\n\tdataClass: import(\"./index\").PlatformDataClass,\n\tpolicy: import(\"./engine\").AnonymizationPolicy,\n): import(\"./index\").AnonymizationResult<TValue> {\n\treturn new AnonymizationEngine(policy).anonymizeJsonValue(value, context, dataClass);\n}\n\nexport function anonymizeAssetEventPayload(\n\tevent: AssetEventLike,\n\tcontext: import(\"./index\").AnonymizationContext,\n\tpolicy: import(\"./engine\").AnonymizationPolicy,\n): import(\"./index\").AnonymizationResult<unknown> {\n\treturn new AnonymizationEngine(policy).anonymizeAssetEventPayload(event, context);\n}\n\nexport function anonymizeEvidencePacket(\n\tpacket: EvidencePacketLike,\n\tcontext: import(\"./index\").AnonymizationContext,\n\tpolicy: import(\"./engine\").AnonymizationPolicy,\n): import(\"./index\").AnonymizationResult<Pick<EvidencePacketLike, \"packet\" | \"redactionMetadata\" | \"checksum\">> {\n\treturn new AnonymizationEngine(policy).anonymizeEvidencePacket(packet, context);\n}\n\nexport function buildAnonymizationLifecycleEvidence(input: {\n\tcontext: import(\"./index\").AnonymizationContext;\n\tassetEvents?: Array<{ event: AssetEventLike; metadata: import(\"./index\").AnonymizationMetadata }>;\n\treadModels?: Array<{\n\t\tmodelKind: string;\n\t\trecord: Record<string, unknown> & { id: string };\n\t\tmetadata: import(\"./index\").AnonymizationMetadata;\n\t}>;\n\tevidencePackets?: Array<{ packet: EvidencePacketLike; metadata: import(\"./index\").AnonymizationMetadata }>;\n}, policy: import(\"./engine\").AnonymizationPolicy): AnonymizationLifecycleEvidence {\n\treturn new AnonymizationEngine(policy).buildAnonymizationLifecycleEvidence(input);\n}\n\nexport type PlatformDataClass =\n\t| \"asset_event\"\n\t| \"read_model\"\n\t| \"raw_payload\"\n\t| \"evidence_packet\"\n\t| \"action_evidence\"\n\t| \"access_event\";\n\nexport interface RedactionRule {\n\tfieldPath: string;\n\tmethod: RedactionMethod;\n\treason: string;\n\tdataClass?: PlatformDataClass;\n}\n\nexport interface DataClassificationRule {\n\tfieldPath: string;\n\tclassification: string;\n\tcontainsDirectIdentifier?: boolean;\n\tcontainsSensitiveData?: boolean;\n}\n\nexport interface AnonymizationContext {\n\ttenantId: string;\n\tspaceId?: string | null;\n\tjobId: string;\n\treason: string;\n\tredactedAt?: Date;\n\tpolicyVersion?: string;\n}\n\nexport interface AnonymizationFieldMetadata {\n\tfieldPath: string;\n\tmethod: RedactionMethod;\n\tpolicyVersion: string;\n\tjobId: string;\n\tredactedAt: string;\n\treason: string;\n\tdataClass: PlatformDataClass;\n\tbeforeChecksum: string;\n}\n\nexport interface AnonymizationMetadata {\n\tredactionState: \"anonymized\";\n\tpolicyVersion: string;\n\tjobId: string;\n\tredactedAt: string;\n\treason: string;\n\tdataClass: PlatformDataClass;\n\tredactedFields: AnonymizationFieldMetadata[];\n\tpreservedSemantics: string[];\n}\n\nexport interface AnonymizationResult<TValue> {\n\tvalue: TValue;\n\tmetadata: AnonymizationMetadata;\n}\n\nexport interface AnalyticsDataContractSource {\n\tname: string;\n\tprivacyClass:\n\t\t| \"raw\"\n\t\t| \"operational_pii\"\n\t\t| \"tenant_scoped_tokenized\"\n\t\t| \"anonymized\"\n\t\t| \"aggregated\"\n\t\t| \"differentially_minimized\";\n\tcontainsDirectIdentifiers?: boolean;\n\tcontainsGloballyStablePersonTokens?: boolean;\n\tanonymizationPolicyVersion?: string;\n\tminimumGroupSize?: number;\n}\n\nexport interface AnalyticsDataContract {\n\tcontractId: string;\n\tstatus: \"draft\" | \"accepted\" | \"deprecated\";\n\tcrossTenant: boolean;\n\tacceptedBy?: string;\n\tacceptedAt?: string;\n\tadrReference?: string;\n\tsources: AnalyticsDataContractSource[];\n}\n\nexport interface AnalyticsEligibilityDecision {\n\teligible: boolean;\n\tpolicyVersion: string;\n\treasons: string[];\n}\n\nexport interface RetentionRule {\n\tdataClass: PlatformDataClass;\n\tretainForDays: number;\n\tafterRetention: \"delete\" | \"anonymize\" | \"archive\";\n\tlegalHoldExempt?: boolean;\n}\n"]}

package/dist/chunk-BFQNKQJE.cjs

@@ -0,0 +1,53 @@
+'use strict';
+
+// actions/index.ts
+var ACTOR_TYPES = [
+  "natural_person",
+  "agent",
+  "system",
+  "service_account",
+  "external_system",
+  "integration"
+];
+function isActorType(value) {
+  return ACTOR_TYPES.includes(value);
+}
+function assertActorType(value) {
+  if (!isActorType(value)) {
+    throw new Error(`Invalid actorType: ${value}`);
+  }
+}
+function assertActionId(actionId) {
+  if (!/^[a-z][a-z0-9-]*\.[a-z][a-z0-9_]*$/.test(actionId)) {
+    throw new Error(`Invalid action ID: ${actionId}`);
+  }
+}
+function createActionRegistry(definitions = []) {
+  const actions = /* @__PURE__ */ new Map();
+  const register = (definition) => {
+    assertActionId(definition.actionId);
+    if (actions.has(definition.actionId)) throw new Error(`Action "${definition.actionId}" is already registered`);
+    if (definition.mutatesDomain && definition.emitsEvents.length === 0) {
+      throw new Error(`Action "${definition.actionId}" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);
+    }
+    actions.set(definition.actionId, definition);
+  };
+  for (const definition of definitions) register(definition);
+  return {
+    register,
+    registerIfMissing(definition) {
+      if (!actions.has(definition.actionId)) register(definition);
+    },
+    resolve: (actionId) => actions.get(actionId),
+    has: (actionId) => actions.has(actionId),
+    ids: () => Array.from(actions.keys())
+  };
+}
+
+exports.ACTOR_TYPES = ACTOR_TYPES;
+exports.assertActionId = assertActionId;
+exports.assertActorType = assertActorType;
+exports.createActionRegistry = createActionRegistry;
+exports.isActorType = isActorType;
+//# sourceMappingURL=chunk-BFQNKQJE.cjs.map
+//# sourceMappingURL=chunk-BFQNKQJE.cjs.map

package/dist/{chunk-4RMKUYRX.js.map → chunk-BFQNKQJE.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../actions/index.ts"],"names":[],"mappings":";AAwBO,IAAM,WAAA,GAAoC;AAAA,EAChD,gBAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACD;AAEO,SAAS,YAAY,KAAA,EAAmC;AAC9D,EAAA,OAAQ,WAAA,CAAkC,SAAS,KAAK,CAAA;AACzD;AAEO,SAAS,gBAAgB,KAAA,EAA2C;AAC1E,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EAC9C;AACD;AA2KA,IAAM,QAAA,uBAAe,GAAA,EAAgC;AAE9C,SAAS,eAAe,QAAA,EAAgD;AAC9E,EAAA,IAAI,CAAC,oCAAA,CAAqC,IAAA,CAAK,QAAQ,CAAA,EAAG;AACzD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAE,CAAA;AAAA,EACjD;AACD;AAEO,SAAS,eAAe,UAAA,EAAoC;AAClE,EAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAElC,EAAA,IAAI,QAAA,CAAS,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,uBAAA,CAAyB,CAAA;AAAA,EACxE;AAEA,EAAA,IAAI,UAAA,CAAW,aAAA,IAAiB,UAAA,CAAW,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,QAAA,EAAW,WAAW,QAAQ,CAAA,8FAAA;AAAA,KAE/B;AAAA,EACD;AAEA,EAAA,QAAA,CAAS,GAAA,CAAI,UAAA,CAAW,QAAA,EAAU,UAAU,CAAA;AAC7C;AAEO,SAAS,cAAc,QAAA,EAAkD;AAC/E,EAAA,OAAO,QAAA,CAAS,IAAI,QAAQ,CAAA;AAC7B;AAEO,SAAS,qBAAqB,QAAA,EAAwC;AAC5E,EAAA,OAAO,QAAA,CAAS,IAAI,QAAoB,CAAA;AACzC;AAEO,SAAS,wBAAwB,QAAA,EAAgD;AACvF,EAAA,IAAI,CAAC,oBAAA,CAAqB,QAAQ,CAAA,EAAG;AACpC,IAAA,OAAO,MAAA;AAAA,EACR;AAEA,EAAA,OAAO,cAAc,QAAQ,CAAA;AAC9B;AAEO,SAAS,sBAAA,GAAqC;AACpD,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,CAAA;AAClC;AAEO,SAAS,wBAAwB,UAAA,EAAoC;AAC3E,EAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG;AACvC,IAAA,cAAA,CAAe,UAAU,CAAA;AAAA,EAC1B;AACD","file":"chunk-4RMKUYRX.js","sourcesContent":["export type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n}\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\tcompletion: ActionCompletionMode;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent signals with the same name received before another\n\t * `awaitSignal` call are buffered (FIFO) so no signal is lost.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nconst registry = new Map<ActionId, ActionDefinition>();\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport function registerAction(definition: ActionDefinition): void {\n\tassertActionId(definition.actionId);\n\n\tif (registry.has(definition.actionId)) {\n\t\tthrow new Error(`Action \"${definition.actionId}\" is already registered`);\n\t}\n\n\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\tthrow new Error(\n\t\t\t`Action \"${definition.actionId}\" mutates domain but emits no events. ` +\n\t\t\t\t`Every mutating action must emit at least one AssetEvent.`,\n\t\t);\n\t}\n\n\tregistry.set(definition.actionId, definition);\n}\n\nexport function resolveAction(actionId: ActionId): ActionDefinition | undefined {\n\treturn registry.get(actionId);\n}\n\nexport function isRegisteredActionId(actionId: string): actionId is ActionId {\n\treturn registry.has(actionId as ActionId);\n}\n\nexport function resolveRegisteredAction(actionId: string): ActionDefinition | undefined {\n\tif (!isRegisteredActionId(actionId)) {\n\t\treturn undefined;\n\t}\n\n\treturn resolveAction(actionId);\n}\n\nexport function getRegisteredActionIds(): ActionId[] {\n\treturn Array.from(registry.keys());\n}\n\nexport function registerActionIfMissing(definition: ActionDefinition): void {\n\tif (!registry.has(definition.actionId)) {\n\t\tregisterAction(definition);\n\t}\n}\n"]}
+{"version":3,"sources":["../actions/index.ts"],"names":[],"mappings":";;;AAwBO,IAAM,WAAA,GAAoC;AAAA,EAChD,gBAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACD;AAEO,SAAS,YAAY,KAAA,EAAmC;AAC9D,EAAA,OAAQ,WAAA,CAAkC,SAAS,KAAK,CAAA;AACzD;AAEO,SAAS,gBAAgB,KAAA,EAA2C;AAC1E,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EAC9C;AACD;AA2KO,SAAS,eAAe,QAAA,EAAgD;AAC9E,EAAA,IAAI,CAAC,oCAAA,CAAqC,IAAA,CAAK,QAAQ,CAAA,EAAG;AACzD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAE,CAAA;AAAA,EACjD;AACD;AAUO,SAAS,oBAAA,CAAoC,WAAA,GAAgD,EAAC,EAAwB;AAC5H,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAqC;AACzD,EAAA,MAAM,QAAA,GAAW,CAAC,UAAA,KAA4C;AAC7D,IAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,uBAAA,CAAyB,CAAA;AAC7G,IAAA,IAAI,UAAA,CAAW,aAAA,IAAiB,UAAA,CAAW,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,8FAAA,CAAgG,CAAA;AAAA,IAC/I;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAA,EAAU,UAAU,CAAA;AAAA,EAC5C,CAAA;AACA,EAAA,KAAA,MAAW,UAAA,IAAc,WAAA,EAAa,QAAA,CAAS,UAAU,CAAA;AACzD,EAAA,OAAO;AAAA,IACN,QAAA;AAAA,IACA,kBAAkB,UAAA,EAAY;AAC7B,MAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,QAAQ,CAAA,WAAY,UAAU,CAAA;AAAA,IAC3D,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,QAAA,KAAa,OAAA,CAAQ,IAAI,QAAQ,CAAA;AAAA,IAC3C,GAAA,EAAK,CAAC,QAAA,KAAmC,OAAA,CAAQ,IAAI,QAAoB,CAAA;AAAA,IACzE,KAAK,MAAM,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,MAAM;AAAA,GACrC;AACD","file":"chunk-BFQNKQJE.cjs","sourcesContent":["export type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n}\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\tcompletion: ActionCompletionMode;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent signals with the same name received before another\n\t * `awaitSignal` call are buffered (FIFO) so no signal is lost.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"]}

package/dist/{chunk-OC4ZFJKD.cjs → chunk-CBY6GRJP.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
 // objects/index.ts
-var objectTypeRegistry = /* @__PURE__ */ new Set([
+var BUILT_IN_OBJECT_TYPES = Object.freeze([
   "AssetEvent",
   "ActionInvocation",
   "PolicyEvaluation",
@@ -9,7 +9,7 @@ var objectTypeRegistry = /* @__PURE__ */ new Set([
   "ConsentRecord",
   "AgentRun"
 ]);
-var supportedSchemaKeywords = /* @__PURE__ */ new Set([
+var supportedSchemaKeywords = Object.freeze([
   "$schema",
   "$id",
   "$ref",
@@ -61,7 +61,7 @@ function assertPortableJsonSchema(schema, path = "schema") {
   }
   const value = schema;
   for (const keyword of Object.keys(value)) {
-    if (!supportedSchemaKeywords.has(keyword) && !keyword.startsWith("x-")) {
+    if (!supportedSchemaKeywords.includes(keyword) && !keyword.startsWith("x-")) {
       throw new Error(`${path} uses unsupported JSON Schema keyword "${keyword}".`);
     }
   }
@@ -121,21 +121,20 @@ function assertObjectType(type) {
     );
   }
 }
-function registerObjectType(type) {
-  assertObjectType(type);
-  objectTypeRegistry.add(type);
-}
-function isValidObjectType(type) {
-  return objectTypeRegistry.has(type);
-}
-function getRegisteredObjectTypes() {
-  return Array.from(objectTypeRegistry);
+function createObjectTypeRegistry(initialTypes = []) {
+  const objectTypes = /* @__PURE__ */ new Set([...BUILT_IN_OBJECT_TYPES, ...initialTypes]);
+  return {
+    register(type) {
+      assertObjectType(type);
+      objectTypes.add(type);
+    },
+    has: (type) => objectTypes.has(type),
+    list: () => Array.from(objectTypes).sort()
+  };
 }
 
 exports.assertObjectType = assertObjectType;
 exports.assertPortableJsonSchema = assertPortableJsonSchema;
-exports.getRegisteredObjectTypes = getRegisteredObjectTypes;
-exports.isValidObjectType = isValidObjectType;
-exports.registerObjectType = registerObjectType;
-//# sourceMappingURL=chunk-OC4ZFJKD.cjs.map
-//# sourceMappingURL=chunk-OC4ZFJKD.cjs.map
+exports.createObjectTypeRegistry = createObjectTypeRegistry;
+//# sourceMappingURL=chunk-CBY6GRJP.cjs.map
+//# sourceMappingURL=chunk-CBY6GRJP.cjs.map

package/dist/chunk-CBY6GRJP.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../objects/index.ts"],"names":[],"mappings":";;;AAAA,IAAM,qBAAA,GAAwB,OAAO,MAAA,CAAO;AAAA,EAC3C,YAAA;AAAA,EACA,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA,iBAAA;AAAA,EACA,eAAA;AAAA,EACA;AACD,CAAC,CAAA;AA4DD,IAAM,uBAAA,GAA0B,OAAO,MAAA,CAAO;AAAA,EAC7C,SAAA;AAAA,EAAW,KAAA;AAAA,EAAO,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,aAAA;AAAA,EAAe,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,OAAA;AAAA,EAC3E,YAAA;AAAA,EAAc,UAAA;AAAA,EAAY,sBAAA;AAAA,EAAwB,OAAA;AAAA,EAAS,aAAA;AAAA,EAAe,eAAA;AAAA,EAAiB,mBAAA;AAAA,EAAqB,mBAAA;AAAA,EAAqB,OAAA;AAAA,EAAS,OAAA;AAAA,EAAS,OAAA;AAAA,EACvJ,KAAA;AAAA,EAAO,SAAA;AAAA,EAAW,SAAA;AAAA,EAAW,kBAAA;AAAA,EAAoB,kBAAA;AAAA,EAAoB,WAAA;AAAA,EACrE,WAAA;AAAA,EAAa,SAAA;AAAA,EAAW,QAAA;AAAA,EAAU,UAAA;AAAA,EAAY,UAAA;AAAA,EAAY,aAAA;AAAA,EAAe,SAAA;AAAA,EACzE,UAAA;AAAA,EAAY,WAAA;AAAA,EAAa,YAAA;AAAA,EAAc,iBAAA;AAAA,EAAmB,kBAAA;AAAA,EAAoB,YAAA;AAAA,EAAc,IAAA;AAAA,EAAM,MAAA;AAAA,EAAQ,MAAA;AAAA,EAAQ,UAAA;AAAA,EAAY;AAC/H,CAAC,CAAA;AAEM,SAAS,wBAAA,CACf,MAAA,EACA,IAAA,GAAO,QAAA,EACgC;AACvC,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AACnE,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,8BAAA,CAAgC,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,KAAA,GAAQ,MAAA;AACd,EAAA,KAAA,MAAW,OAAA,IAAW,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,EAAG;AACzC,IAAA,IAAI,CAAC,wBAAwB,QAAA,CAAS,OAAO,KAAK,CAAC,OAAA,CAAQ,UAAA,CAAW,IAAI,CAAA,EAAG;AAC5E,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,uCAAA,EAA0C,OAAO,CAAA,EAAA,CAAI,CAAA;AAAA,IAC7E;AAAA,EACD;AACA,EAAA,IAAI,KAAA,CAAM,eAAe,MAAA,EAAW;AACnC,IAAA,IAAI,CAAC,KAAA,CAAM,UAAA,IAAc,OAAO,KAAA,CAAM,UAAA,KAAe,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,UAAU,CAAA,EAAG;AACjG,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,8BAAA,CAAgC,CAAA;AAAA,IACxD;AACA,IAAA,KAAA,MAAW,CAAC,MAAM,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,UAAU,CAAA,EAAG;AAC7D,MAAA,wBAAA,CAAyB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,YAAA,EAAe,IAAI,CAAA,CAAE,CAAA;AAAA,IAC7D;AAAA,EACD;AACA,EAAA,IAAI,KAAA,CAAM,UAAU,MAAA,EAAW;AAC9B,IAAA,IAAI,CAAC,KAAA,CAAM,KAAA,IAAS,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAClF,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,yBAAA,CAA2B,CAAA;AAAA,IACnD;AACA,IAAA,KAAA,MAAW,CAAC,MAAM,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AACxD,MAAA,wBAAA,CAAyB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,OAAA,EAAU,IAAI,CAAA,CAAE,CAAA;AAAA,IACxD;AAAA,EACD;AACA,EAAA,IAAI,KAAA,CAAM,sBAAsB,MAAA,EAAW;AAC1C,IAAA,IAAI,CAAC,KAAA,CAAM,iBAAA,IAAqB,OAAO,KAAA,CAAM,sBAAsB,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,iBAAiB,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,qCAAA,CAAuC,CAAA;AACrL,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,iBAAiB,CAAA,2BAA4B,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,mBAAA,EAAsB,IAAI,CAAA,CAAE,CAAA;AAAA,EACzI;AACA,EAAA,KAAA,MAAW,OAAA,IAAW,CAAC,OAAA,EAAS,OAAA,EAAS,OAAO,CAAA,EAAY;AAC3D,IAAA,IAAI,KAAA,CAAM,OAAO,CAAA,KAAM,MAAA,EAAW;AACjC,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAC,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,kBAAA,CAAoB,CAAA;AAC1F,MAAA,KAAA,CAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,CAAC,OAAO,KAAA,KAAU,wBAAA,CAAyB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,EAAI,KAAK,GAAG,CAAC,CAAA;AAAA,IACzG;AAAA,EACD;AACA,EAAA,IAAI,KAAA,CAAM,QAAQ,MAAA,EAAW,wBAAA,CAAyB,MAAM,GAAA,EAAK,CAAA,EAAG,IAAI,CAAA,IAAA,CAAM,CAAA;AAC9E,EAAA,KAAA,MAAW,OAAA,IAAW,CAAC,eAAA,EAAiB,IAAA,EAAM,QAAQ,MAAM,CAAA,MAAgB,KAAA,CAAM,OAAO,MAAM,MAAA,EAAW,wBAAA,CAAyB,MAAM,OAAO,CAAA,EAAG,GAAG,IAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAE,CAAA;AACvK,EAAA,IAAI,MAAM,oBAAA,KAAyB,MAAA,IAAa,OAAO,KAAA,CAAM,yBAAyB,SAAA,EAAW;AAChG,IAAA,wBAAA,CAAyB,KAAA,CAAM,oBAAA,EAAsB,CAAA,EAAG,IAAI,CAAA,qBAAA,CAAuB,CAAA;AAAA,EACpF;AACA,EAAA,IAAI,KAAA,CAAM,UAAU,MAAA,EAAW;AAC9B,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAC/B,MAAA,KAAA,CAAM,KAAA,CAAM,OAAA,CAAQ,CAAC,KAAA,EAAO,KAAA,KAAU,wBAAA,CAAyB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,CAAG,CAAC,CAAA;AAAA,IACjG,CAAA,MAAO;AACN,MAAA,wBAAA,CAAyB,KAAA,CAAM,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,MAAA,CAAQ,CAAA;AAAA,IACtD;AAAA,EACD;AACA,EAAA,IAAI,KAAA,CAAM,gBAAgB,MAAA,EAAW;AACpC,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,WAAW,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,8BAAA,CAAgC,CAAA;AAC9F,IAAA,KAAA,CAAM,WAAA,CAAY,OAAA,CAAQ,CAAC,KAAA,EAAO,KAAA,KAAU,wBAAA,CAAyB,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAA,CAAG,CAAC,CAAA;AAAA,EAC7G;AACA,EAAA,IAAI,KAAA,CAAM,sBAAsB,MAAA,EAAW;AAC1C,IAAA,IAAI,CAAC,KAAA,CAAM,iBAAA,IAAqB,OAAO,KAAA,CAAM,sBAAsB,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,iBAAiB,CAAA,IAAK,MAAA,CAAO,OAAO,KAAA,CAAM,iBAAiB,EAAE,IAAA,CAAK,CAAC,KAAA,KAAU,CAAC,MAAM,OAAA,CAAQ,KAAK,KAAK,KAAA,CAAM,IAAA,CAAK,CAAC,IAAA,KAAS,OAAO,IAAA,KAAS,QAAQ,CAAC,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,uEAAA,CAAyE,CAAA;AAAA,EAC3V;AACA,EAAA,IAAI,MAAM,QAAA,KAAa,MAAA,KAAc,CAAC,KAAA,CAAM,QAAQ,KAAA,CAAM,QAAQ,CAAA,IAAK,KAAA,CAAM,SAAS,IAAA,CAAK,CAAC,SAAS,OAAO,IAAA,KAAS,QAAQ,CAAA,CAAA,EAAI;AAChI,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,6CAAA,CAA+C,CAAA;AAAA,EACvE;AACD;AAEO,SAAS,iBAAiB,IAAA,EAAgD;AAChF,EAAA,IAAI,CAAC,qBAAA,CAAsB,IAAA,CAAK,IAAI,CAAA,EAAG;AACtC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,yBAAyB,IAAI,CAAA,gDAAA;AAAA,KAC9B;AAAA,EACD;AACD;AAQO,SAAS,wBAAA,CAAyB,YAAA,GAAkC,EAAC,EAAuB;AAClG,EAAA,MAAM,WAAA,uBAAkB,GAAA,CAAI,CAAC,GAAG,qBAAA,EAAuB,GAAG,YAAY,CAAC,CAAA;AACvE,EAAA,OAAO;AAAA,IACN,SAAS,IAAA,EAAM;AACd,MAAA,gBAAA,CAAiB,IAAI,CAAA;AACrB,MAAA,WAAA,CAAY,IAAI,IAAI,CAAA;AAAA,IACrB,CAAA;AAAA,IACA,GAAA,EAAK,CAAC,IAAA,KAAS,WAAA,CAAY,IAAI,IAAI,CAAA;AAAA,IACnC,MAAM,MAAM,KAAA,CAAM,IAAA,CAAK,WAAW,EAAE,IAAA;AAAK,GAC1C;AACD","file":"chunk-CBY6GRJP.cjs","sourcesContent":["const BUILT_IN_OBJECT_TYPES = Object.freeze([\n\t\"AssetEvent\",\n\t\"ActionInvocation\",\n\t\"PolicyEvaluation\",\n\t\"ApprovalRequest\",\n\t\"ConsentRecord\",\n\t\"AgentRun\",\n]);\n\nexport type FabricObjectType = string;\n\nexport type JsonPrimitive = string | number | boolean | null;\nexport type JsonValue = JsonPrimitive | JsonValue[] | { [key: string]: JsonValue };\n\n/**\n * Dependency-free JSON Schema profile accepted in portable module manifests.\n * Unknown extension keywords must use an `x-` prefix. Runtime validators may\n * support more vocabulary, but exported entity contracts stay in this profile.\n */\nexport interface PortableJsonSchema {\n\t$schema?: string;\n\t$id?: string;\n\t$ref?: string;\n\t$defs?: Record<string, PortableJsonSchema>;\n\ttitle?: string;\n\tdescription?: string;\n\ttype?: \"null\" | \"boolean\" | \"object\" | \"array\" | \"number\" | \"integer\" | \"string\" | Array<\"null\" | \"boolean\" | \"object\" | \"array\" | \"number\" | \"integer\" | \"string\">;\n\tenum?: JsonValue[];\n\tconst?: JsonValue;\n\tproperties?: Record<string, PortableJsonSchema>;\n\trequired?: string[];\n\tadditionalProperties?: boolean | PortableJsonSchema;\n\titems?: PortableJsonSchema | PortableJsonSchema[];\n\tprefixItems?: PortableJsonSchema[];\n\tpropertyNames?: PortableJsonSchema;\n\tpatternProperties?: Record<string, PortableJsonSchema>;\n\tdependentRequired?: Record<string, string[]>;\n\tallOf?: PortableJsonSchema[];\n\tanyOf?: PortableJsonSchema[];\n\toneOf?: PortableJsonSchema[];\n\tnot?: PortableJsonSchema;\n\tif?: PortableJsonSchema;\n\tthen?: PortableJsonSchema;\n\telse?: PortableJsonSchema;\n\tminimum?: number;\n\tmaximum?: number;\n\texclusiveMinimum?: number;\n\texclusiveMaximum?: number;\n\tmultipleOf?: number;\n\tminLength?: number;\n\tmaxLength?: number;\n\tpattern?: string;\n\tformat?: string;\n\tminItems?: number;\n\tmaxItems?: number;\n\tuniqueItems?: boolean;\n\tdefault?: JsonValue;\n\treadOnly?: boolean;\n\twriteOnly?: boolean;\n\tdeprecated?: boolean;\n\tcontentEncoding?: string;\n\tcontentMediaType?: string;\n\texamples?: JsonValue[];\n\t$comment?: string;\n\t[key: `x-${string}`]: JsonValue | undefined;\n}\n\nconst supportedSchemaKeywords = Object.freeze([\n\t\"$schema\", \"$id\", \"$ref\", \"$defs\", \"title\", \"description\", \"type\", \"enum\", \"const\",\n\t\"properties\", \"required\", \"additionalProperties\", \"items\", \"prefixItems\", \"propertyNames\", \"patternProperties\", \"dependentRequired\", \"allOf\", \"anyOf\", \"oneOf\",\n\t\"not\", \"minimum\", \"maximum\", \"exclusiveMinimum\", \"exclusiveMaximum\", \"minLength\",\n\t\"maxLength\", \"pattern\", \"format\", \"minItems\", \"maxItems\", \"uniqueItems\", \"default\",\n\t\"readOnly\", \"writeOnly\", \"deprecated\", \"contentEncoding\", \"contentMediaType\", \"multipleOf\", \"if\", \"then\", \"else\", \"examples\", \"$comment\",\n]);\n\nexport function assertPortableJsonSchema(\n\tschema: unknown,\n\tpath = \"schema\",\n): asserts schema is PortableJsonSchema {\n\tif (!schema || typeof schema !== \"object\" || Array.isArray(schema)) {\n\t\tthrow new Error(`${path} must be a JSON Schema object.`);\n\t}\n\tconst value = schema as Record<string, unknown>;\n\tfor (const keyword of Object.keys(value)) {\n\t\tif (!supportedSchemaKeywords.includes(keyword) && !keyword.startsWith(\"x-\")) {\n\t\t\tthrow new Error(`${path} uses unsupported JSON Schema keyword \"${keyword}\".`);\n\t\t}\n\t}\n\tif (value.properties !== undefined) {\n\t\tif (!value.properties || typeof value.properties !== \"object\" || Array.isArray(value.properties)) {\n\t\t\tthrow new Error(`${path}.properties must be an object.`);\n\t\t}\n\t\tfor (const [name, child] of Object.entries(value.properties)) {\n\t\t\tassertPortableJsonSchema(child, `${path}.properties.${name}`);\n\t\t}\n\t}\n\tif (value.$defs !== undefined) {\n\t\tif (!value.$defs || typeof value.$defs !== \"object\" || Array.isArray(value.$defs)) {\n\t\t\tthrow new Error(`${path}.$defs must be an object.`);\n\t\t}\n\t\tfor (const [name, child] of Object.entries(value.$defs)) {\n\t\t\tassertPortableJsonSchema(child, `${path}.$defs.${name}`);\n\t\t}\n\t}\n\tif (value.patternProperties !== undefined) {\n\t\tif (!value.patternProperties || typeof value.patternProperties !== \"object\" || Array.isArray(value.patternProperties)) throw new Error(`${path}.patternProperties must be an object.`);\n\t\tfor (const [name, child] of Object.entries(value.patternProperties)) assertPortableJsonSchema(child, `${path}.patternProperties.${name}`);\n\t}\n\tfor (const keyword of [\"allOf\", \"anyOf\", \"oneOf\"] as const) {\n\t\tif (value[keyword] !== undefined) {\n\t\t\tif (!Array.isArray(value[keyword])) throw new Error(`${path}.${keyword} must be an array.`);\n\t\t\tvalue[keyword].forEach((child, index) => assertPortableJsonSchema(child, `${path}.${keyword}[${index}]`));\n\t\t}\n\t}\n\tif (value.not !== undefined) assertPortableJsonSchema(value.not, `${path}.not`);\n\tfor (const keyword of [\"propertyNames\", \"if\", \"then\", \"else\"] as const) if (value[keyword] !== undefined) assertPortableJsonSchema(value[keyword], `${path}.${keyword}`);\n\tif (value.additionalProperties !== undefined && typeof value.additionalProperties !== \"boolean\") {\n\t\tassertPortableJsonSchema(value.additionalProperties, `${path}.additionalProperties`);\n\t}\n\tif (value.items !== undefined) {\n\t\tif (Array.isArray(value.items)) {\n\t\t\tvalue.items.forEach((child, index) => assertPortableJsonSchema(child, `${path}.items[${index}]`));\n\t\t} else {\n\t\t\tassertPortableJsonSchema(value.items, `${path}.items`);\n\t\t}\n\t}\n\tif (value.prefixItems !== undefined) {\n\t\tif (!Array.isArray(value.prefixItems)) throw new Error(`${path}.prefixItems must be an array.`);\n\t\tvalue.prefixItems.forEach((child, index) => assertPortableJsonSchema(child, `${path}.prefixItems[${index}]`));\n\t}\n\tif (value.dependentRequired !== undefined) {\n\t\tif (!value.dependentRequired || typeof value.dependentRequired !== \"object\" || Array.isArray(value.dependentRequired) || Object.values(value.dependentRequired).some((items) => !Array.isArray(items) || items.some((item) => typeof item !== \"string\"))) throw new Error(`${path}.dependentRequired must map property names to arrays of property names.`);\n\t}\n\tif (value.required !== undefined && (!Array.isArray(value.required) || value.required.some((item) => typeof item !== \"string\"))) {\n\t\tthrow new Error(`${path}.required must be an array of property names.`);\n\t}\n}\n\nexport function assertObjectType(type: string): asserts type is FabricObjectType {\n\tif (!/^[A-Z][a-zA-Z0-9]*$/.test(type)) {\n\t\tthrow new Error(\n\t\t\t`Invalid object type: \"${type}\". Object types must be PascalCase alphanumeric.`,\n\t\t);\n\t}\n}\n\nexport interface ObjectTypeRegistry {\n\tregister(type: string): void;\n\thas(type: string): boolean;\n\tlist(): string[];\n}\n\nexport function createObjectTypeRegistry(initialTypes: readonly string[] = []): ObjectTypeRegistry {\n\tconst objectTypes = new Set([...BUILT_IN_OBJECT_TYPES, ...initialTypes]);\n\treturn {\n\t\tregister(type) {\n\t\t\tassertObjectType(type);\n\t\t\tobjectTypes.add(type);\n\t\t},\n\t\thas: (type) => objectTypes.has(type),\n\t\tlist: () => Array.from(objectTypes).sort(),\n\t};\n}\n"]}

package/dist/chunk-CQSA3BII.js

@@ -0,0 +1,38 @@
+// events/index.ts
+var BUILT_IN_SUBJECT_TYPES = Object.freeze([
+  "ActionInvocation",
+  "PolicyEvaluation",
+  "AdapterInvocation"
+]);
+var BUILT_IN_EVENT_TYPES = Object.freeze([
+  "ComplianceBlocked",
+  "StateTransitioned",
+  "AdapterInvocationStarted",
+  "AdapterInvocationSucceeded",
+  "AdapterInvocationFailed",
+  "WebhookReceived"
+]);
+function createEventContractRegistry(input = {}) {
+  const eventTypes = /* @__PURE__ */ new Set([...BUILT_IN_EVENT_TYPES, ...input.eventTypes ?? []]);
+  const subjectTypes = /* @__PURE__ */ new Set([...BUILT_IN_SUBJECT_TYPES, ...input.subjectTypes ?? []]);
+  return {
+    registerEventType(eventType) {
+      if (!eventType) {
+        throw new Error("Event type cannot be empty");
+      }
+      eventTypes.add(eventType);
+    },
+    registerSubjectType(subjectType) {
+      if (!subjectType) throw new Error("Subject type cannot be empty");
+      subjectTypes.add(subjectType);
+    },
+    hasEventType: (eventType) => eventTypes.has(eventType),
+    hasSubjectType: (subjectType) => subjectTypes.has(subjectType),
+    eventTypes: () => Array.from(eventTypes).sort(),
+    subjectTypes: () => Array.from(subjectTypes).sort()
+  };
+}
+
+export { createEventContractRegistry };
+//# sourceMappingURL=chunk-CQSA3BII.js.map
+//# sourceMappingURL=chunk-CQSA3BII.js.map

package/dist/chunk-CQSA3BII.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../events/index.ts"],"names":[],"mappings":";AAyBA,IAAM,sBAAA,GAAyB,OAAO,MAAA,CAAO;AAAA,EAC5C,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACD,CAAC,CAAA;AAED,IAAM,oBAAA,GAAuB,OAAO,MAAA,CAAO;AAAA,EAC1C,mBAAA;AAAA,EACA,mBAAA;AAAA,EACA,0BAAA;AAAA,EACA,4BAAA;AAAA,EACA,yBAAA;AAAA,EACA;AACD,CAAC,CAAA;AAeM,SAAS,2BAAA,CAA4B,KAAA,GAA8E,EAAC,EAA0B;AACpJ,EAAA,MAAM,UAAA,mBAAa,IAAI,GAAA,CAAI,CAAC,GAAG,oBAAA,EAAsB,GAAI,KAAA,CAAM,UAAA,IAAc,EAAG,CAAC,CAAA;AACjF,EAAA,MAAM,YAAA,mBAAe,IAAI,GAAA,CAAI,CAAC,GAAG,sBAAA,EAAwB,GAAI,KAAA,CAAM,YAAA,IAAgB,EAAG,CAAC,CAAA;AACvF,EAAA,OAAO;AAAA,IACN,kBAAkB,SAAA,EAAW;AAC5B,MAAA,IAAI,CAAC,SAAA,EAAW;AACf,QAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,MAC7C;AACA,MAAA,UAAA,CAAW,IAAI,SAAS,CAAA;AAAA,IACzB,CAAA;AAAA,IACA,oBAAoB,WAAA,EAAa;AAChC,MAAA,IAAI,CAAC,WAAA,EAAa,MAAM,IAAI,MAAM,8BAA8B,CAAA;AAChE,MAAA,YAAA,CAAa,IAAI,WAAW,CAAA;AAAA,IAC7B,CAAA;AAAA,IACA,YAAA,EAAc,CAAC,SAAA,KAAc,UAAA,CAAW,IAAI,SAAS,CAAA;AAAA,IACrD,cAAA,EAAgB,CAAC,WAAA,KAAgB,YAAA,CAAa,IAAI,WAAW,CAAA;AAAA,IAC7D,YAAY,MAAM,KAAA,CAAM,IAAA,CAAK,UAAU,EAAE,IAAA,EAAK;AAAA,IAC9C,cAAc,MAAM,KAAA,CAAM,IAAA,CAAK,YAAY,EAAE,IAAA;AAAK,GACnD;AACD","file":"chunk-CQSA3BII.js","sourcesContent":["export interface AssetEventEnvelope<TPayload = unknown> {\n\tid: string;\n\ttenantId: string;\n\tspaceId: string;\n\teventType: string;\n\teventSchemaVersion: number;\n\tsubjectType: string;\n\tsubjectId: string;\n\tactorId: string;\n\tactorType: string;\n\tactionInvocationId?: string;\n\tpayload: TPayload;\n\tsequence: number;\n\toccurredAt: Date;\n\trecordedAt: Date;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: EventProvenance;\n}\n\nexport interface EventProvenance {\n\tsource: \"ui\" | \"api\" | \"agent\" | \"worker\" | \"system\" | (string & {});\n\tauditAttributes?: Record<string, string>;\n}\n\nconst BUILT_IN_SUBJECT_TYPES = Object.freeze([\n\t\"ActionInvocation\",\n\t\"PolicyEvaluation\",\n\t\"AdapterInvocation\",\n]);\n\nconst BUILT_IN_EVENT_TYPES = Object.freeze([\n\t\"ComplianceBlocked\",\n\t\"StateTransitioned\",\n\t\"AdapterInvocationStarted\",\n\t\"AdapterInvocationSucceeded\",\n\t\"AdapterInvocationFailed\",\n\t\"WebhookReceived\",\n]);\n\nexport type AssetEventSubjectType = string;\nexport type AssetEventType = string;\nexport type AssetEventActorType = \"natural_person\" | \"agent\" | \"adapter\" | \"system\" | \"service_account\" | \"external_system\" | \"integration\";\n\nexport interface EventContractRegistry {\n\tregisterEventType(eventType: string): void;\n\tregisterSubjectType(subjectType: string): void;\n\thasEventType(eventType: string): boolean;\n\thasSubjectType(subjectType: string): boolean;\n\teventTypes(): string[];\n\tsubjectTypes(): string[];\n}\n\nexport function createEventContractRegistry(input: { eventTypes?: readonly string[]; subjectTypes?: readonly string[] } = {}): EventContractRegistry {\n\tconst eventTypes = new Set([...BUILT_IN_EVENT_TYPES, ...(input.eventTypes ?? [])]);\n\tconst subjectTypes = new Set([...BUILT_IN_SUBJECT_TYPES, ...(input.subjectTypes ?? [])]);\n\treturn {\n\t\tregisterEventType(eventType) {\n\t\t\tif (!eventType) {\n\t\t\t\tthrow new Error(\"Event type cannot be empty\");\n\t\t\t}\n\t\t\teventTypes.add(eventType);\n\t\t},\n\t\tregisterSubjectType(subjectType) {\n\t\t\tif (!subjectType) throw new Error(\"Subject type cannot be empty\");\n\t\t\tsubjectTypes.add(subjectType);\n\t\t},\n\t\thasEventType: (eventType) => eventTypes.has(eventType),\n\t\thasSubjectType: (subjectType) => subjectTypes.has(subjectType),\n\t\teventTypes: () => Array.from(eventTypes).sort(),\n\t\tsubjectTypes: () => Array.from(subjectTypes).sort(),\n\t};\n}\n"]}

package/dist/{chunk-ZO6HPMCK.js → chunk-CRAGTJ3B.js}

@@ -1,4 +1,4 @@
-import { getEventTypeName, getObjectTypeName, getModuleDependencyNamespace } from './chunk-5PDVZXEI.js';
+import { getEventTypeName, getObjectTypeName, getModuleDependencyNamespace } from './chunk-T5ESIJ4K.js';
 
 // manifest/index.ts
 var MODULE_MANIFEST_VERSION = 2;
@@ -224,5 +224,5 @@ function exportModuleManifestBundle(modules) {
 }
 
 export { MODULE_MANIFEST_VERSION, exportModuleManifest, exportModuleManifestBundle, isJsonSchemaExportableValidator, normalizeModuleManifest, normalizeModuleManifestBundle };
-//# sourceMappingURL=chunk-ZO6HPMCK.js.map
-//# sourceMappingURL=chunk-ZO6HPMCK.js.map
+//# sourceMappingURL=chunk-CRAGTJ3B.js.map
+//# sourceMappingURL=chunk-CRAGTJ3B.js.map